CVE-2026-71365

AWX's webhook status callback mechanism extracts the statuses_url from GitHub pull request payloads without validating the target host. An admin-role user can forge a signed webhook with an arbitrary URL, causing AWX to POST authenticated status updates with the Git PAT in the Authorization heade...

CVE-2026-71365 Awx: webhook status callback ssrf leaks the git pat

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

EUVD-2026-61015

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

PT-2026-77190

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pull request.statuses url from the incoming webhook payload without validating the target host against the...